Privacy Notice
GEXCAP Inc. ("we") operates the Margos & Partners platform. This notice explains what personal data we collect through it, why, who else sees it, and what you can do about it.
Last updated: 14 August 2026. The platform is a beta release; see the Terms & Conditions.
1. Who is responsible
GEXCAP Inc., a company incorporated in the United States, is the controller of the personal data you give to this platform. We are established outside the European Union and we offer this service to people in the EU, so the General Data Protection Regulation applies to us.
Representative in the European Union. Article 27 of the GDPR requires a controller established outside the Union, offering services to people inside it, to designate a representative in a member state in writing. Our designation is being put in place; the representative's name and address will be published in this section as soon as it is, and this notice will carry the date of that change.
In the meantime, and afterwards, you may raise any data protection matter with us directly at office@margospartners.com and we will answer within one month. None of the rights in section 8 depends on that designation, and none of them is suspended while it is being made.
We keep a technical service office in Malta which maintains this website. It performs no client work and takes no decisions about your data.
2. What we collect
What you tell the assistant. The conversation itself, and the details you enter in it — your situation, the service you are asking about, and the contact details you give us.
Files you upload. Documents you attach to a conversation, and their metadata.
Account data, where you create one: your email address, sign-in credentials and conversation history.
Records of contact: messages, enquiries, and any invoices or payments.
Technical logs: requests to the service, errors, and administrative actions, kept for security and to make the platform work.
Website measurement. Where enabled, we count arrivals. This is done without cookies and without storing your IP address: a visitor is distinguished within a single day by a one-way, salted digest that cannot be reversed and that does not identify the same person on a later day. We can count how many people came, from where, on what device and in what language. We cannot follow an individual over time.
We do not ask for special category data — health, beliefs, biometrics — and you should not put it into the assistant. If your matter requires it, give it to the law firm once it is engaged, not to this platform.
3. Why, and on what legal basis
| What | Why | Basis | |---|---|---| | Your enquiry and conversation | To understand what you need and prepare a summary | Steps at your request before a contract (Art. 6(1)(b)) | | Passing your enquiry to a law firm | To get you to somebody who can act | Steps at your request; our legitimate interest in operating an introduction service (Art. 6(1)(b), (f)) | | Account and history | To let you return to your own conversations | Contract (Art. 6(1)(b)) | | Security and technical logs | To keep the platform working and safe | Legitimate interest (Art. 6(1)(f)) | | Marketing about the services here | To tell you about services you may want | Consent, or legitimate interest for a similar existing enquiry (Art. 6(1)(a), (f)) | | Keeping records of what was said | To answer complaints and meet legal obligations | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) |
4. Automated processing, and what it is not
Your messages are sent to an automated language model to generate a reply, a summary or a draft. Where a third-party model provider operates that model, your content is transmitted to that provider under its terms.
This is not automated decision-making that produces legal effects for you. The assistant does not decide anything about you: it does not accept or refuse you as a client, does not price your matter bindingly, and does not decide whether a firm takes your case. A human at an independent law firm makes that decision.
If you would rather your material were not processed this way, do not put it in the assistant — write to us instead.
5. Who else sees your data
The Collaborating Firm. When your enquiry is passed to an independent Maltese law firm, that firm receives the enquiry and the summary so it can consider your matter. From that point the firm is a controller in its own right, under its own privacy notice and its own professional duty of confidentiality. We do not control what it does with your data and we are not responsible for it.
Our processors, acting only on our instructions: hosting, model providers, email delivery, and payment providers where you pay through the platform. We do not receive or store card details.
Authorities, where the law requires it.
We do not sell personal data, and we do not share it with advertising networks or data brokers.
6. Transfers outside the EEA
Operating this platform involves transferring personal data to the United States, and possibly to other countries outside the European Economic Area, including through the providers named above.
Those transfers are made on a lawful basis under Chapter V of the GDPR — either an adequacy decision covering the recipient, or the European Commission's Standard Contractual Clauses together with the supplementary measures those clauses require. Which of the two applies depends on the recipient. We will name the mechanism for any given transfer, and give you a copy of the safeguards, on request at office@margospartners.com.
Where a transfer would have no lawful basis, it is not made. Personal data you give this platform is not transferred outside the EEA except as described in this section.
7. How long we keep it
Enquiries and conversations, and the documents generated from them, for as long as needed to deal with your matter and afterwards for as long as complaints and limitation periods require. Account data for as long as the account exists, and a short period afterwards. Technical and security logs for a short retention period. Marketing consent records for as long as we rely on the consent, and afterwards as proof that it was given.
During the beta, data may be deleted earlier than any of this — see clause B.3 of the Terms. Keep your own copy of anything you need.
8. Your rights
You have the right to ask us for access to your personal data, correction of it, erasure, restriction of processing, and portability, and to object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time, and withdrawing costs nothing and does not affect what was done before.
Write to office@margospartners.com. We answer within one month. We may need to confirm who you are first.
If you are unhappy with how we handle it, you may complain to a supervisory authority — in Malta, the Information and Data Protection Commissioner (idpc.org.mt) — or to the authority where you live or work.
Rights about a matter a law firm is handling for you should be exercised against that firm, which holds that data as its own controller.
9. Security, and breaches
We keep the platform behind access control, encrypt data in transit, and log administrative actions. No system is perfect. Where a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours of becoming aware of it, and we tell you directly where the risk to you is high.
10. Changes
We may update this notice. The version in force is the one on this page, and the date at the top is when it last changed.
11. Contact
GEXCAP Inc., operator of the Margos & Partners platform — office@margospartners.com